BSD Portswww/rubygem-cgi_multipart_eof_fix 2.5.0 FreeBSD
Fix an exploitable bug in CGI multipart parsing
- System
- FreeBSD
- Repository
- FreeBSD ports
- Maintainer
- [email protected]
- License
- GPLv2, RUBY
- Categories
- www, rubygems
- Package size
- 14.3 KiB, 36.8 KiB installed
Description
Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.
\* Affected application servers: standalone CGI, Mongrel, WEBrick
\* Unaffected: FastCGI, Ruby 1.8.6 (all servers)
\* Unknown: mod\_ruby
This fix will not modify versions of Ruby greater than 1.8.5, and is cumulative with previous CGI multipart vulnerability fixes.
In the other systems
| System | Port | Version |
|---|---|---|
| FreeBSD | www/rubygem-cgi_multipart_eof_fix | 2.5.0 |
| DragonFly | www/rubygem-cgi_multipart_eof_fix | 2.5.0 |
Install
Binary package:
pkg install rubygem-cgi_multipart_eof_fixFrom the ports tree:
cd /usr/ports/www/rubygem-cgi_multipart_eof_fix/ && make install cleanTo depend on this port in another port's Makefile:
RUN_DEPENDS= rubygem-cgi_multipart_eof_fix>0:www/rubygem-cgi_multipart_eof_fixPackages
The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.
| Repository | aarch64 | amd64 | armv6 | armv7 | i386 |
|---|---|---|---|---|---|
| FreeBSD:14:latest | 2.5.0 | 2.5.0 | 2.5.0 | 2.5.0 | 2.5.0 |
| FreeBSD:14:quarterly | 2.5.0 | 2.5.0 | n/a | 2.5.0 | 2.5.0 |
| FreeBSD:15:latest | 2.5.0 | 2.5.0 | n/a | 2.5.0 | 2.5.0 |
| FreeBSD:15:quarterly | 2.5.0 | 2.5.0 | n/a | n/a | n/a |
| FreeBSD:16:latest | 2.5.0 | 2.5.0 | n/a | n/a | n/a |
| FreeBSD:16:quarterly | n/a | n/a | n/a | n/a | n/a |
Dependencies
The Makefile names none itself; they come from USES and USE_*.
The full lists below include those, and their dependencies in turn.
Build dependencies 6
Run dependencies 6
No port depends on this one.
Configuration
No options to configure.
- USES
- gem
- Service scripts
- none
Files
distinfo 1
| File | Size | SHA256 |
|---|---|---|
| rubygem/cgi_multipart_eof_fix-2.5.0.gem | 11776 | f6638858f2748f2701ae96fc7a939000f0feba1870011483d7d10662140cd672 |
Master sites 1
- RG
Commit history 0
No commits in the history this site was built from.